Authentication documentation in Rest API - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this HTTP response with Bearer token?

Given this HTTP request header for authentication:

Authorization: Bearer abc123token

What is the expected server response status code if the token is valid?

A 200 OK

B 401 Unauthorized

C 403 Forbidden

D 500 Internal Server Error

💡 Hint

Think about what status code means success when token is valid.

A valid Bearer token means the user is authenticated, so the server responds with 200 OK. 401 means unauthorized (no or invalid token), 403 means forbidden (authenticated but no permission), 500 means server error.

🧠 Conceptual

intermediate

Which authentication method uses a shared secret key?

Choose the authentication method that relies on a shared secret key between client and server.

A OAuth 2.0 Authorization Code Flow

B API Key Authentication

C JWT (JSON Web Token) without secret

D Basic Authentication with username only

💡 Hint

Think about which method requires a secret key sent or stored by both client and server.

API Key Authentication uses a shared secret key that the client sends with requests. OAuth 2.0 uses tokens and authorization codes, JWT requires a secret to sign tokens but not shared directly, Basic Auth requires username and password.

🔧 Debug

advanced

Why does this API return 401 Unauthorized despite sending a token?

Consider this HTTP request header:

Authorization: Bearer

The server responds with 401 Unauthorized. What is the most likely cause?

A The server does not support Bearer tokens

B The token is expired but still sent

C The Authorization header is misspelled

D The Bearer token is missing after the word 'Bearer'

💡 Hint

Check the format of the Authorization header carefully.

The Authorization header must include the word 'Bearer' followed by a space and the token. Here, the token is missing, so the server rejects the request with 401 Unauthorized.

📝 Syntax

advanced

Which Authorization header is correctly formatted for Basic Auth?

Choose the correctly formatted Authorization header for Basic Authentication with username 'user' and password 'pass'.

A Authorization: Basic dXNlcjpwYXNz

B Authorization: Basic user:pass

C Authorization: Basic base64(user:pass)

D Authorization: Basic 'dXNlcjpwYXNz'

💡 Hint

Remember Basic Auth requires base64 encoding of 'username:password'.

The string 'user:pass' base64 encoded is 'dXNlcjpwYXNz'. The header must be 'Authorization: Basic ' followed by this encoded string without quotes.

🚀 Application

expert

How many scopes are granted in this OAuth 2.0 token response?

Given this OAuth 2.0 token response JSON:

{
  "access_token": "abc123",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "read write delete"
}

How many scopes does this token grant?

A 2

B 1

C 3

D 4

💡 Hint

Count the number of space-separated scopes in the 'scope' field.

The 'scope' field contains three scopes: 'read', 'write', and 'delete'.

Practice

1. What is the main purpose of authentication in a REST API?

easy

A. To speed up the API response time

B. To encrypt the data sent over the network

C. To format the API response in JSON

D. To confirm the identity of a user or client

Solution

1. Step 1: Understand authentication role

   Authentication is about confirming who the user or client is.

2. Step 2: Differentiate from other API functions

   Encryption, speed, and formatting are different concerns, not authentication.

3. Final Answer:

   To confirm the identity of a user or client -> Option D

4. Quick Check:

   Authentication = Confirm identity [OK]

Hint: Authentication means confirming who you are [OK]

Common Mistakes:

• Confusing authentication with encryption
• Thinking authentication speeds up API
• Mixing authentication with data formatting

2. Which of the following is the correct way to send an authentication token in a REST API request header?

easy

A. Token: <token>

B. Auth-Token: <token>

C. Authorization: Bearer <token>

D. Access: <token>

Solution

1. Step 1: Recall standard header format

   The standard way to send tokens is using the 'Authorization' header with 'Bearer' prefix.

2. Step 2: Compare options

   Only Authorization: Bearer <token> uses the correct 'Authorization: Bearer <token>' format.

3. Final Answer:

   Authorization: Bearer <token> -> Option C

4. Quick Check:

   Token header = Authorization: Bearer [OK]

Hint: Use 'Authorization: Bearer' to send tokens [OK]

Common Mistakes:

• Using wrong header names like 'Token' or 'Access'
• Omitting 'Bearer' keyword before token
• Placing token in URL instead of header

3. Given this API request code snippet, what will be the output if the token is missing?

fetch('https://api.example.com/data', {
  headers: { 'Authorization': 'Bearer ' }
})
.then(response => response.status)
.then(status => console.log(status));

medium

A. 401

B. 404

C. 500

D. 200

Solution

1. Step 1: Understand missing token effect

   When the token is missing or empty, the server usually rejects the request as unauthorized.

2. Step 2: Identify HTTP status code for unauthorized

   The standard status code for unauthorized access is 401.

3. Final Answer:

   401 -> Option A

4. Quick Check:

   Missing token = 401 Unauthorized [OK]

Hint: Missing token causes 401 Unauthorized error [OK]

Common Mistakes:

• Assuming missing token returns 200 OK
• Confusing 401 with 404 Not Found
• Thinking server returns 500 error

4. Identify the error in this authentication header usage:

headers: {
  'Authorization': 'BearerToken abc123'
}

medium

A. Missing space between 'Bearer' and token

B. Token should be in lowercase

C. Authorization header should be 'Auth' instead

D. Token must be sent as a query parameter

Solution

1. Step 1: Check Authorization header format

   The correct format requires a space between 'Bearer' and the token string.

2. Step 2: Verify the given header

   The header uses 'BearerToken' without space, which is incorrect.

3. Final Answer:

   Missing space between 'Bearer' and token -> Option A

4. Quick Check:

   Bearer and token need space [OK]

Hint: Add space after 'Bearer' before token [OK]

Common Mistakes:

• Writing 'BearerToken' as one word
• Using wrong header name like 'Auth'
• Sending token in URL instead of header

5. You want to secure an API endpoint so only authenticated users can access it. Which combination is best practice for this in your API documentation?

hard

A. Allow clients to send username and password in every request body

B. Require clients to send a valid token in the 'Authorization: Bearer <token>' header for access

C. Use IP address filtering to allow only certain clients

D. Send the token as a URL parameter for easy access

Solution

1. Step 1: Identify secure token usage

   Best practice is to require a valid token in the 'Authorization' header to confirm identity securely.

2. Step 2: Evaluate other options

   Sending username/password every time is insecure; IP filtering is limited; URL tokens risk exposure.

3. Final Answer:

   Require clients to send a valid token in the 'Authorization: Bearer <token>' header for access -> Option B

4. Quick Check:

   Token in Authorization header = secure access [OK]

Hint: Use Authorization header with token, not URL or body [OK]

Common Mistakes:

• Sending credentials in every request body
• Exposing tokens in URL parameters
• Relying only on IP filtering for security